REST endpoint to get user permissions?

Question

How can my server for a Connect add-on determine what permissions a user has? I'm looking for ADMINISTER specifically, but it's unlikely to be right-specific.

I found two options, none of which seems ideal:

* /rest/api/2/user/permission/search - according to docs it requires "admin" to access, which is way too strong a scope to ask for an add-on that claims to never ever even write to JIRA.
* /rest/api/2/mypermissions - requires ACT_AS_USER, which seems pretty strong as well (permission to perform any action on behalf of any user? ouch!).

Am I missing something? Are these the only options?

Stephen Deutsch · Answer

I do see your point. If you are using JWT authentication for the requests, though, then you can validate that the requests haven't been tampered with, I think.

Perhaps there is another way to get this information; I'll take another look.

Konrad Garus_ucgohw · Answer

Thanks, but this is pretty weak security. You can't really trust requests coming from the client, assuming that they have always been sent by your app, properly validated on the client side, etc.

Stephen Deutsch · Answer

Of course, this only works if you are doing something that interacts with the user in the browser and is going to present the information right away. If it's reacting to a webhook or something like that, then you probably wouldn't be able to use what I mentioned. In that case, a little bit more information about your use case would be required.